How can I group alerts?

[Rafaeleite2]

I would like some ideas to generate a ticket for each new case. I am integrating SOAR with my ITSM, so I have created a playbook with Alert Trigger whenever a new alert is generated to create a ticket in ITSM. So multiple alerts of the same case can be processed in a single ticket, so I want to generate only one ticket with the same case ID.

[f3rz]

@Rafaeleite2 

You can find grouping documentation here: https://cloud.google.com/chronicle/docs/soar/investigate/working-with-alerts/alert-grouping-mechanis...

Together with grouping I would recommend you to use action "Find First Alert" from "Tools" PowerUp, which will allow you to execute playbook only once per case with multiple alerts by comparing First Alert Identifier to Current Alert Identifier you can differentiate between First Alert or other alerts grouped into single case. 

[dnehoda]

In SOAR settings under alert groupings - you can do quite a few different modifications as to how you want alerts grouped.  Multiple alerts in a specific time frame will end up in the same case and would get sent to an overflow case if it kept triggering. I’d suggest coming up with a mechanism or two to trigger tests and then modify those settings according to your needs. 

[skadav]

@Rafaeleite2  You can control alert grouping by navigating to SOAR Settings -> Advanced -> Alert Grouping. Here, you can specify the entities you want to group alerts by, such as Source IP, Username, or Assignment Group. This setup will help group relevant alerts into a single case based on the entities you choose.

Once your grouping is set up, if you need to trigger only one alert per case, attach your playbook exclusively to the first alert. To do this, use the Find First Alert action (found in Playbook Actions -> Tools -> Find First Alert). This ensures that the playbook triggers only once for each grouped case.

Hope this helps! Let me know if you have further questions.

[SoarAndy]

Another approach:

Leave Alert Grouping enabled
At the beginning of every Alert have a Block "AmIFirst" (I have attached a copy of mine, I have added some blocks that start "ZZ_" as pseudo logic for you to consider and build out)

In this block:
If an Alert is first in the case, then you create a ticket in ITSM and store the ITSM ID at a Case value [case.itsmID]
If the Alert is not first in the case, then update ITSM to add a comment "new alert auto grouped"
etc

Edit - I can't attach my Block, DM me to work out how to distribute


HTH